The Secure Copy Content Protection and Content Locking WordPress plugin, versions prior to 5.1.5, fails to sanitise and escape the ays_sccp_sub_icon_image configuration setting. This oversight allows an attacker with administrative privileges to store malicious JavaScript directly in the plugin’s settings. When a page that displays the stored value is loaded, the script executes in the context of the admin user, enabling arbitrary code execution, data theft, site defacement, or session hijacking.

WordPress sites running the Secure Copy Content Protection and Content Locking plugin older than version 5.1.5. No other vendors or products are affected according to the data provided.

The vulnerability is a stored XSS that requires authenticated access with administrative rights, so the attack vector is an authenticated request to the plugin’s configuration interface. The CVSS score of 3.5 and an EPSS score of less than 1% indicate low overall severity, yet the privileged scope means a malicious payload would run with high‑privilege user privileges. The issue is not listed in the CISA KEV catalog, and no public exploit code is known, but an attacker who can gain or already possesses admin rights can directly employ the flaw.